Analysis
- max time kernel
92s - max time network
95s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
- submitted
03/06/2024, 11:33
General
- Target a1f5d87f8c6e91297978b6b15854ad50_NeikiAnalytics.exe
- Size 200KB
- Sample240603-nn1laaec59
- SHA256 12a6a0a19ac07d4c202c93d53a6ba485ecb6fba7f23a4bf9ae539e418b8027c4
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- Program crash 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1f5d87f8c6e91297978b6b15854ad50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a1f5d87f8c6e91297978b6b15854ad50_NeikiAnalytics.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 3962⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\a1f5d87f8c6e91297978b6b15854ad50_NeikiAnalytics.exeC:\Users\Admin\AppData\Local\Temp\a1f5d87f8c6e91297978b6b15854ad50_NeikiAnalytics.exe2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 3683⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2436 -ip 24361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2644 -ip 26441⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
a1f5d87f8c6e91297978b6b15854ad50_NeikiAnalytics.exe
memory/2436-0-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2436-6-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2644-7-0x0000000000400000-0x000000000043F000-memory.dmp
memory/2644-8-0x0000000000400000-0x000000000041A000-memory.dmp
memory/2644-13-0x0000000001650000-0x000000000168F000-memory.dmp